Format code.

This commit is contained in:
Andy Nguyen
2026-05-12 23:01:40 +02:00
parent 4b5fc13e80
commit f87828b554
39 changed files with 3121 additions and 3127 deletions

View File

@@ -1,39 +1,39 @@
ifndef PS5_PAYLOAD_SDK
PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/
endif
# 1. Variables
ifeq ($(shell uname -m),aarch64)
CC = x86_64-linux-gnu-gcc
LD = x86_64-linux-gnu-ld
OBJCOPY = x86_64-linux-gnu-objcopy
else
CC = gcc
LD = ld
OBJCOPY = objcopy
endif
CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -m64 -I$(PS5_PAYLOAD_SDK)/target/include
LDFLAGS = -T linker.ld
TARGET = shellcode_hypervisor.elf
TEXT_BIN = shellcode_hypervisor.bin
dump = shellcode_hypervisor.h
SRC = main.c utils.c boot_linux.c
OBJ = $(SRC:.c=.o)
all: $(dump)
$(TARGET): $(OBJ)
$(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET)
%.o: %.c
$(CC) $(CFLAGS) -c $< -o $@
$(TEXT_BIN): $(TARGET)
$(OBJCOPY) -O binary -j .shell_code $(TARGET) $(TEXT_BIN)
clean:
rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump)
$(dump): $(TEXT_BIN)
python3 bin_to_c_hypervisor.py $(TEXT_BIN)
ifndef PS5_PAYLOAD_SDK
PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/
endif
# 1. Variables
ifeq ($(shell uname -m),aarch64)
CC = x86_64-linux-gnu-gcc
LD = x86_64-linux-gnu-ld
OBJCOPY = x86_64-linux-gnu-objcopy
else
CC = gcc
LD = ld
OBJCOPY = objcopy
endif
CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -m64 -I$(PS5_PAYLOAD_SDK)/target/include
LDFLAGS = -T linker.ld
TARGET = shellcode_hypervisor.elf
TEXT_BIN = shellcode_hypervisor.bin
dump = shellcode_hypervisor.h
SRC = main.c utils.c boot_linux.c
OBJ = $(SRC:.c=.o)
all: $(dump)
$(TARGET): $(OBJ)
$(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET)
%.o: %.c
$(CC) $(CFLAGS) -c $< -o $@
$(TEXT_BIN): $(TARGET)
$(OBJCOPY) -O binary -j .shell_code $(TARGET) $(TEXT_BIN)
clean:
rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump)
$(dump): $(TEXT_BIN)
python3 bin_to_c_hypervisor.py $(TEXT_BIN)

View File

@@ -1,46 +1,46 @@
import sys
import os
def create_shellcode_header(input_file):
if not os.path.exists(input_file):
print(f"Error: {input_file} not found.")
return
# Read binary data_text
with open(input_file, "rb") as f:
data_text = f.read()
# Hardcoded output name
output_name = "shellcode_hypervisor.h"
array_name = "shellcode_hypervisor"
with open(output_name, "w") as f:
f.write(f"// Generated from {input_file}\n")
f.write(f"#ifndef SHELLCODE_HV_H\n")
f.write(f"#define SHELLCODE_HV_H\n\n")
f.write(f"#include <unistd.h>\n\n")
f.write(f"uint8_t {array_name}[] = {{\n ")
for i, byte in enumerate(data_text):
f.write(f"0x{byte:02X}")
if i < len(data_text) - 1:
f.write(", ")
# New line every 12 bytes
if (i + 1) % 12 == 0:
f.write("\n ")
f.write(f"\n}};\n\n")
f.write(f"uint64_t {array_name}_len = {len(data_text)};\n\n")
f.write(f"#endif // SHELLCODE_HV_H\n")
print(f"Done! Created {output_name} ({len(data_text)} bytes)")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python bin_to_c_hypervisor.py <shellcode.bin>")
else:
create_shellcode_header(sys.argv[1])
import sys
import os
def create_shellcode_header(input_file):
if not os.path.exists(input_file):
print(f"Error: {input_file} not found.")
return
# Read binary data_text
with open(input_file, "rb") as f:
data_text = f.read()
# Hardcoded output name
output_name = "shellcode_hypervisor.h"
array_name = "shellcode_hypervisor"
with open(output_name, "w") as f:
f.write(f"// Generated from {input_file}\n")
f.write(f"#ifndef SHELLCODE_HV_H\n")
f.write(f"#define SHELLCODE_HV_H\n\n")
f.write(f"#include <unistd.h>\n\n")
f.write(f"uint8_t {array_name}[] = {{\n ")
for i, byte in enumerate(data_text):
f.write(f"0x{byte:02X}")
if i < len(data_text) - 1:
f.write(", ")
# New line every 12 bytes
if (i + 1) % 12 == 0:
f.write("\n ")
f.write(f"\n}};\n\n")
f.write(f"uint64_t {array_name}_len = {len(data_text)};\n\n")
f.write(f"#endif // SHELLCODE_HV_H\n")
print(f"Done! Created {output_name} ({len(data_text)} bytes)")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python bin_to_c_hypervisor.py <shellcode.bin>")
else:
create_shellcode_header(sys.argv[1])

View File

@@ -94,8 +94,7 @@ static void e820_memory_setup(struct boot_params *bp) {
if (info.kit_type != KIT_DEVKIT) {
append_e820_table(bp, 0x470000000, 0x47f300000, E820_TYPE_RAM);
append_e820_table(bp, 0x47f300000, 0x480000000, E820_TYPE_RESERVED);
}
else {
} else {
append_e820_table(bp, 0x470000000, 0x87f300000, E820_TYPE_RAM);
append_e820_table(bp, 0x87f300000, 0x880000000, E820_TYPE_RESERVED);
}
@@ -133,7 +132,6 @@ void boot_linux(void) {
memcpy((void *)kernel_pa, (void *)(info.bzimage + setup_size), kernel_size);
void (*startup_64)(uint64_t physaddr, struct boot_params *bp) =
(void *)(kernel_pa + 0x200);
startup_64(kernel_pa, bp);

View File

@@ -1,52 +1,48 @@
#define MSR_EFER 0xc0000080
#define EFER_SVM (1ULL << 12) // Bit 12: Secure Virtual Machine Enable
// // Virtual Machine Control Register (VM_CR)
#define MSR_VM_CR 0xc0010114
#define VM_CR_R_INIT (1ULL << 1) // Bit 1: Intercept INIT
// // MTRRs (Memory Type Range Registers)
#define MSR_MTRR4kBase 0x00000268
#define MSR_MTRRVarBase 0x00000200
#define VRAM_BASE (0x470000000 - info.vram_size)
#define FB_BASE 0xf400000000
#define ACPI_RSDP_ADDRESS 0x7fd8e014
#define AMDGPU_MMIO_BASE 0xe0600000
#define RCC_CONFIG_MEMSIZE 0x378c
#define GCMC_VM_FB_OFFSET 0xa5ac
#define GCMC_VM_LOCAL_HBM_ADDRESS_START 0xa5d4
#define GCMC_VM_LOCAL_HBM_ADDRESS_END 0xa5d8
#define GCMC_VM_FB_LOCATION_BASE 0xa600
#define GCMC_VM_FB_LOCATION_TOP 0xa604
#define MMMC_VM_FB_OFFSET 0x6a15c
#define MMMC_VM_LOCAL_HBM_ADDRESS_START 0x6a184
#define MMMC_VM_LOCAL_HBM_ADDRESS_END 0x6a188
#define MMMC_VM_FB_LOCATION_BASE 0x6a1b0
#define MMMC_VM_FB_LOCATION_TOP 0x6a1b4
#define MMHUBBUB_WHITELIST_BASE_ADDR_0 0x24850
#define MMHUBBUB_WHITELIST_TOP_ADDR_0 0x24854
#define DCHUBBUB_WHITELIST_BASE_ADDR_0 0x24878
#define DCHUBBUB_WHITELIST_TOP_ADDR_0 0x2487c
#define AMDIOMMU_MMIO_BASE 0xfdd80000
#define AMDIOMMU_CTRL 0x18
#define MAXCPU 16
void entry(void);
void boot_linux(void);
enum kit_type {
KIT_RETAIL,
KIT_TESTKIT,
KIT_DEVKIT
};
#define MSR_EFER 0xc0000080
#define EFER_SVM (1ULL << 12) // Bit 12: Secure Virtual Machine Enable
// // Virtual Machine Control Register (VM_CR)
#define MSR_VM_CR 0xc0010114
#define VM_CR_R_INIT (1ULL << 1) // Bit 1: Intercept INIT
// // MTRRs (Memory Type Range Registers)
#define MSR_MTRR4kBase 0x00000268
#define MSR_MTRRVarBase 0x00000200
#define VRAM_BASE (0x470000000 - info.vram_size)
#define FB_BASE 0xf400000000
#define ACPI_RSDP_ADDRESS 0x7fd8e014
#define AMDGPU_MMIO_BASE 0xe0600000
#define RCC_CONFIG_MEMSIZE 0x378c
#define GCMC_VM_FB_OFFSET 0xa5ac
#define GCMC_VM_LOCAL_HBM_ADDRESS_START 0xa5d4
#define GCMC_VM_LOCAL_HBM_ADDRESS_END 0xa5d8
#define GCMC_VM_FB_LOCATION_BASE 0xa600
#define GCMC_VM_FB_LOCATION_TOP 0xa604
#define MMMC_VM_FB_OFFSET 0x6a15c
#define MMMC_VM_LOCAL_HBM_ADDRESS_START 0x6a184
#define MMMC_VM_LOCAL_HBM_ADDRESS_END 0x6a188
#define MMMC_VM_FB_LOCATION_BASE 0x6a1b0
#define MMMC_VM_FB_LOCATION_TOP 0x6a1b4
#define MMHUBBUB_WHITELIST_BASE_ADDR_0 0x24850
#define MMHUBBUB_WHITELIST_TOP_ADDR_0 0x24854
#define DCHUBBUB_WHITELIST_BASE_ADDR_0 0x24878
#define DCHUBBUB_WHITELIST_TOP_ADDR_0 0x2487c
#define AMDIOMMU_MMIO_BASE 0xfdd80000
#define AMDIOMMU_CTRL 0x18
#define MAXCPU 16
void entry(void);
void boot_linux(void);
enum kit_type { KIT_RETAIL, KIT_TESTKIT, KIT_DEVKIT };

View File

@@ -1,18 +1,18 @@
/* linker.ld */
ENTRY(main)
SECTIONS
{
. = 0x1000; /* 0x1000 to avoid warnings from linker */
/* Place our custom header first */
.shell_code :
{
*(.entry_point)
*(.text)
*(.text.*)
*(.data*)
*(.rodata*)
*(.bss)
*(.bss.*)
}
}
/* linker.ld */
ENTRY(main)
SECTIONS
{
. = 0x1000; /* 0x1000 to avoid warnings from linker */
/* Place our custom header first */
.shell_code :
{
*(.entry_point)
*(.text)
*(.text.*)
*(.data*)
*(.rodata*)
*(.bss)
*(.bss.*)
}
}

View File

@@ -1,33 +1,33 @@
#include <stdint.h>
#include "main.h"
#include "../include/config.h"
#include "boot_linux.h"
#include "utils.h"
__attribute__((section(".entry_point"), naked)) uint32_t main(void) {
// We enter this function after CR3 was updated to 1:1 mapping
// We need to point RSP/RBP to a good known valid address
uint32_t ebax, ebx, ecx, edx;
uint32_t cpu_id;
__asm__ volatile("cpuid"
: "=a"(ebax), "=b"(ebx), "=c"(ecx), "=d"(edx)
: "a"(1));
cpu_id = (ebx >> 24) & 0xFF;
// We point to a location after the main linux boot code
// Each CPU should have a different location
uintptr_t new_rsp =
(uintptr_t)hv_base_rsp + ((uint64_t)(cpu_id)*hv_stack_size);
// WARNING: This invalidates current local variables
__asm__ volatile("movq %0, %%rsp \n\t"
"movq %%rsp, %%rbp \n\t"
:
: "r"(new_rsp)
: "rbp", "memory");
entry();
}
#include "main.h"
#include "../include/config.h"
#include "boot_linux.h"
#include "utils.h"
#include <stdint.h>
__attribute__((section(".entry_point"), naked)) uint32_t main(void) {
// We enter this function after CR3 was updated to 1:1 mapping
// We need to point RSP/RBP to a good known valid address
uint32_t ebax, ebx, ecx, edx;
uint32_t cpu_id;
__asm__ volatile("cpuid"
: "=a"(ebax), "=b"(ebx), "=c"(ecx), "=d"(edx)
: "a"(1));
cpu_id = (ebx >> 24) & 0xFF;
// We point to a location after the main linux boot code
// Each CPU should have a different location
uintptr_t new_rsp =
(uintptr_t)hv_base_rsp + ((uint64_t)(cpu_id)*hv_stack_size);
// WARNING: This invalidates current local variables
__asm__ volatile("movq %0, %%rsp \n\t"
"movq %%rsp, %%rbp \n\t"
:
: "r"(new_rsp)
: "rbp", "memory");
entry();
}

View File

@@ -1,3 +1,3 @@
#include "shellcode_hypervisor_args.h"
#include <stdarg.h>
#include <stdint.h>
#include "shellcode_hypervisor_args.h"
#include <stdarg.h>
#include <stdint.h>

View File

@@ -1,9 +1,9 @@
// This file is shared between kernel shellcode and hypervisor shellcode
#include <stdint.h>
typedef struct {
uint64_t bzimage_pa; // Already relocated by Kernel shellcode
uint64_t initrd_pa; // Already relocated by Kernel shellcode
uint64_t linux_info_pa; // Already relocated by Kernel shellcode
} shellcode_hypervisor_args;
// This file is shared between kernel shellcode and hypervisor shellcode
#include <stdint.h>
typedef struct {
uint64_t bzimage_pa; // Already relocated by Kernel shellcode
uint64_t initrd_pa; // Already relocated by Kernel shellcode
uint64_t linux_info_pa; // Already relocated by Kernel shellcode
} shellcode_hypervisor_args;

View File

@@ -1,114 +1,114 @@
#include "utils.h"
#include "shellcode_hypervisor_args.h"
#include <cpuid.h>
extern shellcode_hypervisor_args args;
__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint8_t tx_byte) {
volatile uint32_t *uart_tx = (volatile uint32_t *) 0xc1010104ULL;
volatile uint32_t *uart_busy = (volatile uint32_t *) 0xc101010cULL;
uint64_t timeout = 0xFFFFFFFF;
do {
timeout--;
if (timeout == 0)
break;
} while (((*uart_busy) & 0x20) == 0);
if (timeout == 0)
return -1;
*uart_tx = (uint32_t)tx_byte & 0xFF;
return 0;
}
// Variable for val to hex
uint8_t hex_val[17];
__attribute__((noinline, optimize("O0"))) uint8_t *
u64_to_hex_custom(uint64_t val, uint8_t *dest) {
const uint8_t hex_chars[] = "0123456789abcdef";
dest[16] = '\0';
for (int i = 15; i >= 0; i--) {
dest[i] = hex_chars[val & 0xf];
val >>= 4;
}
return dest;
}
__attribute__((noinline, optimize("O0"))) int printf(const uint8_t *msg) {
uint32_t max = 255;
int ret = 0;
for (int i = 0; i < 255; i++) {
if (msg[i] == '\0') {
break;
}
if (msg[i] == '\n') {
putc_uart('\r');
}
ret = putc_uart(msg[i]);
}
return ret;
}
__attribute__((noinline, optimize("O0"))) void memcpy(void *dest, void *src,
uint64_t len) {
uint8_t *d = (uint8_t *)dest;
const uint8_t *s = (const uint8_t *)src;
for (uint64_t i = 0; i < len; i++) {
d[i] = s[i];
}
}
__attribute__((noinline, optimize("O0"))) char *strcpy(char *dest,
const char *src) {
char *d = dest;
while ((*d++ = *src++)) {
}
return dest;
}
__attribute__((noinline, optimize("O0"))) void *memset(void *s, int c,
uint64_t n) {
unsigned char *p = (unsigned char *)s;
while (n--) {
*p++ = (unsigned char)c;
}
return s;
}
void disable_intr(void) { __asm__ __volatile__("cli" : : : "memory"); }
void halt(void) { __asm__ __volatile__("hlt"); }
uint64_t rdmsr(uint32_t msr) {
uint32_t low, high;
__asm__ __volatile__("rdmsr" : "=a"(low), "=d"(high) : "c"(msr));
return ((uint64_t)high << 32) | low;
}
void wrmsr(uint32_t msr, uint64_t val) {
uint32_t low = val & 0xFFFFFFFF;
uint32_t high = val >> 32;
__asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr));
}
// Map FreeBSD atomic_add_32 to GCC builtin
void atomic_add_32(volatile uint32_t *p, uint32_t v) {
__sync_fetch_and_add(p, v);
}
// Map FreeBSD atomic_cmpset_32 to GCC builtin
int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src) {
return __sync_bool_compare_and_swap(dst, exp, src);
}
uint8_t get_cpu(void) {
uint32_t eax, ebx, ecx, edx;
__get_cpuid(1, &eax, &ebx, &ecx, &edx);
uint8_t cpu_id = (ebx >> 24) & 0xFF;
return cpu_id;
}
#include "utils.h"
#include "shellcode_hypervisor_args.h"
#include <cpuid.h>
extern shellcode_hypervisor_args args;
__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint8_t tx_byte) {
volatile uint32_t *uart_tx = (volatile uint32_t *)0xc1010104ULL;
volatile uint32_t *uart_busy = (volatile uint32_t *)0xc101010cULL;
uint64_t timeout = 0xFFFFFFFF;
do {
timeout--;
if (timeout == 0)
break;
} while (((*uart_busy) & 0x20) == 0);
if (timeout == 0)
return -1;
*uart_tx = (uint32_t)tx_byte & 0xFF;
return 0;
}
// Variable for val to hex
uint8_t hex_val[17];
__attribute__((noinline, optimize("O0"))) uint8_t *
u64_to_hex_custom(uint64_t val, uint8_t *dest) {
const uint8_t hex_chars[] = "0123456789abcdef";
dest[16] = '\0';
for (int i = 15; i >= 0; i--) {
dest[i] = hex_chars[val & 0xf];
val >>= 4;
}
return dest;
}
__attribute__((noinline, optimize("O0"))) int printf(const uint8_t *msg) {
uint32_t max = 255;
int ret = 0;
for (int i = 0; i < 255; i++) {
if (msg[i] == '\0') {
break;
}
if (msg[i] == '\n') {
putc_uart('\r');
}
ret = putc_uart(msg[i]);
}
return ret;
}
__attribute__((noinline, optimize("O0"))) void memcpy(void *dest, void *src,
uint64_t len) {
uint8_t *d = (uint8_t *)dest;
const uint8_t *s = (const uint8_t *)src;
for (uint64_t i = 0; i < len; i++) {
d[i] = s[i];
}
}
__attribute__((noinline, optimize("O0"))) char *strcpy(char *dest,
const char *src) {
char *d = dest;
while ((*d++ = *src++)) {
}
return dest;
}
__attribute__((noinline, optimize("O0"))) void *memset(void *s, int c,
uint64_t n) {
unsigned char *p = (unsigned char *)s;
while (n--) {
*p++ = (unsigned char)c;
}
return s;
}
void disable_intr(void) { __asm__ __volatile__("cli" : : : "memory"); }
void halt(void) { __asm__ __volatile__("hlt"); }
uint64_t rdmsr(uint32_t msr) {
uint32_t low, high;
__asm__ __volatile__("rdmsr" : "=a"(low), "=d"(high) : "c"(msr));
return ((uint64_t)high << 32) | low;
}
void wrmsr(uint32_t msr, uint64_t val) {
uint32_t low = val & 0xFFFFFFFF;
uint32_t high = val >> 32;
__asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr));
}
// Map FreeBSD atomic_add_32 to GCC builtin
void atomic_add_32(volatile uint32_t *p, uint32_t v) {
__sync_fetch_and_add(p, v);
}
// Map FreeBSD atomic_cmpset_32 to GCC builtin
int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src) {
return __sync_bool_compare_and_swap(dst, exp, src);
}
uint8_t get_cpu(void) {
uint32_t eax, ebx, ecx, edx;
__get_cpuid(1, &eax, &ebx, &ecx, &edx);
uint8_t cpu_id = (ebx >> 24) & 0xFF;
return cpu_id;
}

View File

@@ -1,28 +1,28 @@
#ifndef UTILS_H
#define UTILS_H
#include <stdint.h>
uint32_t putc_uart(uint8_t tx_byte);
int printf(const uint8_t *msg);
uint8_t *u64_to_hex_custom(uint64_t val, uint8_t *dest);
extern uint8_t hex_val[17];
inline int print_val64(uint64_t val) {
return printf(u64_to_hex_custom(val, hex_val));
}
void memcpy(void *dest, void *src, uint64_t len);
char *strcpy(char *dest, const char *src);
void *memset(void *s, int c, uint64_t n);
void disable_intr(void);
void halt(void);
uint64_t rdmsr(uint32_t msr);
void wrmsr(uint32_t msr, uint64_t val);
void atomic_add_32(volatile uint32_t *p, uint32_t v);
int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src);
uint8_t get_cpu(void);
#endif
#ifndef UTILS_H
#define UTILS_H
#include <stdint.h>
uint32_t putc_uart(uint8_t tx_byte);
int printf(const uint8_t *msg);
uint8_t *u64_to_hex_custom(uint64_t val, uint8_t *dest);
extern uint8_t hex_val[17];
inline int print_val64(uint64_t val) {
return printf(u64_to_hex_custom(val, hex_val));
}
void memcpy(void *dest, void *src, uint64_t len);
char *strcpy(char *dest, const char *src);
void *memset(void *s, int c, uint64_t n);
void disable_intr(void);
void halt(void);
uint64_t rdmsr(uint32_t msr);
void wrmsr(uint32_t msr, uint64_t val);
void atomic_add_32(volatile uint32_t *p, uint32_t v);
int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src);
uint8_t get_cpu(void);
#endif